#!/bin/bash -x

[[ $XT_MULTI == *xtables-nft-multi ]] || { echo "skip $XT_MULTI"; exit 0; }

set -e

nft flush ruleset

(

	echo "*filter"

	for plen in "" 32 30 24 16 8 0; do

		addr="10.1.2.3${plen:+/}$plen"

		echo "-A OUTPUT -d $addr"

	done

	echo "COMMIT"

) | $XT_MULTI iptables-restore

(

	echo "*filter"

	for plen in "" 128 124 120 112 88 80 64 48 16 8 0; do

		addr="feed:c0ff:ee00:0102:0304:0506:0708:090A${plen:+/}$plen"

		echo "-A OUTPUT -d $addr"

	done

	echo "COMMIT"

) | $XT_MULTI ip6tables-restore

masks="

ff:ff:ff:ff:ff:ff

ff:ff:ff:ff:ff:f0

ff:ff:ff:ff:ff:00

ff:ff:ff:ff:00:00

ff:ff:ff:00:00:00

ff:ff:00:00:00:00

ff:00:00:00:00:00

"

(

	echo "*filter"

	for plen in "" 32 30 24 16 8 0; do

		addr="10.1.2.3${plen:+/}$plen"

		echo "-A OUTPUT -d $addr"

	done

	for mask in $masks; do

		echo "-A OUTPUT --destination-mac fe:ed:00:c0:ff:ee/$mask"

	done

	echo "COMMIT"

) | $XT_MULTI arptables-restore

(

	echo "*filter"

	for mask in $masks; do

		echo "-A OUTPUT -d fe:ed:00:c0:ff:ee/$mask"

	done

	echo "COMMIT"

) | $XT_MULTI ebtables-restore

EXPECT="ip filter OUTPUT 4

  [ payload load 4b @ network header + 16 => reg 1 ]

  [ cmp eq reg 1 0x0302010a ]

  [ counter pkts 0 bytes 0 ]

ip filter OUTPUT 5 4

  [ payload load 4b @ network header + 16 => reg 1 ]

  [ cmp eq reg 1 0x0302010a ]

  [ counter pkts 0 bytes 0 ]

ip filter OUTPUT 6 5

  [ payload load 4b @ network header + 16 => reg 1 ]

  [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]

  [ cmp eq reg 1 0x0002010a ]

  [ counter pkts 0 bytes 0 ]

ip filter OUTPUT 7 6

  [ payload load 3b @ network header + 16 => reg 1 ]

  [ cmp eq reg 1 0x0002010a ]

  [ counter pkts 0 bytes 0 ]

ip filter OUTPUT 8 7

  [ payload load 2b @ network header + 16 => reg 1 ]

  [ cmp eq reg 1 0x0000010a ]

  [ counter pkts 0 bytes 0 ]

ip filter OUTPUT 9 8

  [ payload load 1b @ network header + 16 => reg 1 ]

  [ cmp eq reg 1 0x0000000a ]

  [ counter pkts 0 bytes 0 ]

ip filter OUTPUT 10 9

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 4

  [ payload load 16b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x0a090807 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 5 4

  [ payload load 16b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x0a090807 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 6 5

  [ payload load 16b @ network header + 24 => reg 1 ]

  [ bitwise reg 1 = (reg=1 & 0xffffffff 0xffffffff 0xffffffff 0xf0ffffff ) ^ 0x00000000 0x00000000 0x00000000 0x00000000 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 7 6

  [ payload load 15b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00090807 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 8 7

  [ payload load 14b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x06050403 0x00000807 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 9 8

  [ payload load 11b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x00050403 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 10 9

  [ payload load 10b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee 0x00000403 ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 11 10

  [ payload load 8b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x020100ee ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 12 11

  [ payload load 6b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0xffc0edfe 0x000000ee ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 13 12

  [ payload load 2b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x0000edfe ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 14 13

  [ payload load 1b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x000000fe ]

  [ counter pkts 0 bytes 0 ]

ip6 filter OUTPUT 15 14

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 3

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 4b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x0302010a ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 4 3

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 4b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x0302010a ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 5 4

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 4b @ network header + 24 => reg 1 ]

  [ bitwise reg 1 = (reg=1 & 0xfcffffff ) ^ 0x00000000 ]

  [ cmp eq reg 1 0x0002010a ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 6 5

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 3b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x0002010a ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 7 6

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 2b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x0000010a ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 8 7

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 1b @ network header + 24 => reg 1 ]

  [ cmp eq reg 1 0x0000000a ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 9 8

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 10 9

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 6b @ network header + 18 => reg 1 ]

  [ cmp eq reg 1 0xc000edfe 0x0000eeff ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 11 10

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 6b @ network header + 18 => reg 1 ]

  [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]

  [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 12 11

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 5b @ network header + 18 => reg 1 ]

  [ cmp eq reg 1 0xc000edfe 0x000000ff ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 13 12

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 4b @ network header + 18 => reg 1 ]

  [ cmp eq reg 1 0xc000edfe ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 14 13

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 3b @ network header + 18 => reg 1 ]

  [ cmp eq reg 1 0x0000edfe ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 15 14

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 2b @ network header + 18 => reg 1 ]

  [ cmp eq reg 1 0x0000edfe ]

  [ counter pkts 0 bytes 0 ]

arp filter OUTPUT 16 15

  [ payload load 2b @ network header + 0 => reg 1 ]

  [ cmp eq reg 1 0x00000100 ]

  [ payload load 1b @ network header + 4 => reg 1 ]

  [ cmp eq reg 1 0x00000006 ]

  [ payload load 1b @ network header + 5 => reg 1 ]

  [ cmp eq reg 1 0x00000004 ]

  [ payload load 1b @ network header + 18 => reg 1 ]

  [ cmp eq reg 1 0x000000fe ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 4

  [ payload load 6b @ link header + 0 => reg 1 ]

  [ cmp eq reg 1 0xc000edfe 0x0000eeff ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 5 4

  [ payload load 6b @ link header + 0 => reg 1 ]

  [ bitwise reg 1 = (reg=1 & 0xffffffff 0x0000f0ff ) ^ 0x00000000 0x00000000 ]

  [ cmp eq reg 1 0xc000edfe 0x0000e0ff ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 6 5

  [ payload load 5b @ link header + 0 => reg 1 ]

  [ cmp eq reg 1 0xc000edfe 0x000000ff ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 7 6

  [ payload load 4b @ link header + 0 => reg 1 ]

  [ cmp eq reg 1 0xc000edfe ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 8 7

  [ payload load 3b @ link header + 0 => reg 1 ]

  [ cmp eq reg 1 0x0000edfe ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 9 8

  [ payload load 2b @ link header + 0 => reg 1 ]

  [ cmp eq reg 1 0x0000edfe ]

  [ counter pkts 0 bytes 0 ]

bridge filter OUTPUT 10 9

  [ payload load 1b @ link header + 0 => reg 1 ]

  [ cmp eq reg 1 0x000000fe ]

  [ counter pkts 0 bytes 0 ]

"

diff -u -Z <(echo "$EXPECT") <(nft --debug=netlink list ruleset | awk '/^table/{exit} {print}')